MDL-30042: Sanitize httpwwwroot in mnet jump

hello-josh · Nov 7, 2011 · 2a420f5 · 2a420f5
1 parent 735de1c
commit 2a420f5
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/auth/mnet/jump.php b/auth/mnet/jump.php
@@ -37,6 +37,13 @@
 
 // If hostid hasn't been specified, try getting it using wwwroot
 if (!$hostid) {
+    $hostwwwroot = trim($hostwwwroot);
+    $hostwwwroot = rtrim($hostwwwroot, '/');
+
+    // ensure the wwwroot starts with a http or https prefix
+    if (strtolower(substr($hostwwwroot, 0, 4)) != 'http') {
+        $hostwwwroot = 'http://'.$hostwwwroot;
+    }
     $hostid = $DB->get_field('mnet_host', 'id', array('wwwroot' => $hostwwwroot));
 }